@zudojs/crypto 0.1.0 → 1.0.0

package/dist/cryptoService/cryptoService.derivation.js

@@ -1,12 +1,14 @@
 import { deriveKey } from "../cryptoKeyDerivation/cryptoKeyDerivation.core.js";
-import { cryptoKeyDerivationError } from "@zudojs/errors";
-import { CryptoAlgorithm } from "../cryptoConstants/cryptoConstants.type.js";
-export async function serviceDeriveKey(password, algorithm, options) {
+import { keyDerivationError, rethrowAsCryptoError, } from "../cryptoErrors/cryptoErrors.helper.js";
+export async function serviceDeriveKey(password, algorithm, options, provider) {
     try {
-        return await deriveKey(password, algorithm, options);
+        return await deriveKey(password, algorithm, {
+            ...options,
+            provider: options?.provider ?? provider,
+        });
     }
-    catch {
-        throw cryptoKeyDerivationError("Key derivation failed.", algorithm);
+    catch (error) {
+        return rethrowAsCryptoError(error, (cause) => keyDerivationError("Key derivation failed.", algorithm, cause));
     }
 }
 //# sourceMappingURL=cryptoService.derivation.js.map

package/dist/cryptoService/cryptoService.encoding.js

@@ -1,19 +1,20 @@
 import { encode, decode } from "../cryptoEncoding/cryptoEncoding.core.js";
-import { createCryptoError } from "@zudojs/errors";
+import { CryptoOperation } from "@zudojs/errors";
+import { operationError, rethrowAsCryptoError, } from "../cryptoErrors/cryptoErrors.helper.js";
 export function serviceEncode(value, encoding = "base64url") {
     try {
         return encode(value, encoding);
     }
-    catch {
-        throw createCryptoError("Crypto encoding failed.", {});
+    catch (error) {
+        return rethrowAsCryptoError(error, (cause) => operationError("Crypto encoding failed.", CryptoOperation.ENCODE, cause));
     }
 }
 export function serviceDecode(value, encoding = "base64url") {
     try {
         return decode(value, encoding);
     }
-    catch {
-        throw createCryptoError("Crypto decoding failed.", {});
+    catch (error) {
+        return rethrowAsCryptoError(error, (cause) => operationError("Crypto decoding failed.", CryptoOperation.DECODE, cause));
     }
 }
 //# sourceMappingURL=cryptoService.encoding.js.map

package/dist/cryptoService/index.d.ts

@@ -3,9 +3,5 @@
  *
  * High-level cryptographic service interface.
  */
-export * from "./cryptoService.core.js";
-export { serviceEncrypt, serviceDecrypt, } from "./operations/cryptoService.cipher.js";
-export { serviceHash, serviceHashHex, } from "./operations/cryptoService.hash.js";
-export { serviceHashPassword, serviceVerifyPassword, } from "./operations/cryptoService.password.js";
-export { serviceGenerateToken, serviceGenerateOtp, serviceHashToken, serviceVerifyToken, } from "./operations/cryptoService.token.js";
+export { CryptoService, createCryptoService, cryptoService, getCryptoService, type CryptoServiceOptions, } from "./cryptoService.core.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/cryptoService/index.js

@@ -3,9 +3,5 @@
  *
  * High-level cryptographic service interface.
  */
-export * from "./cryptoService.core.js";
-export { serviceEncrypt, serviceDecrypt, } from "./operations/cryptoService.cipher.js";
-export { serviceHash, serviceHashHex, } from "./operations/cryptoService.hash.js";
-export { serviceHashPassword, serviceVerifyPassword, } from "./operations/cryptoService.password.js";
-export { serviceGenerateToken, serviceGenerateOtp, serviceHashToken, serviceVerifyToken, } from "./operations/cryptoService.token.js";
+export { CryptoService, createCryptoService, cryptoService, getCryptoService, } from "./cryptoService.core.js";
 //# sourceMappingURL=index.js.map

package/dist/cryptoService/operations/cryptoService.cipher.d.ts

@@ -1,5 +1,6 @@
+import type { CryptoProvider } from "../../cryptoProvider/index.js";
 import type { CipherOptions, CipherResult } from "../../cryptoCipher/cryptoCipher.core.js";
 export type { CipherOptions, CipherResult };
-export declare function serviceEncrypt(plaintext: Uint8Array, key: Uint8Array, options?: CipherOptions): Promise<CipherResult>;
-export declare function serviceDecrypt(ciphertext: Uint8Array, key: Uint8Array, iv: Uint8Array, authTag: Uint8Array, aad?: Uint8Array): Promise<Uint8Array>;
+export declare function serviceEncrypt(plaintext: Uint8Array, key: Uint8Array, options?: CipherOptions, provider?: CryptoProvider): Promise<CipherResult>;
+export declare function serviceDecrypt(ciphertext: Uint8Array, key: Uint8Array, iv: Uint8Array, authTag: Uint8Array, aad?: Uint8Array, provider?: CryptoProvider): Promise<Uint8Array>;
 //# sourceMappingURL=cryptoService.cipher.d.ts.map

package/dist/cryptoService/operations/cryptoService.cipher.js

@@ -1,19 +1,23 @@
 import { encrypt, decrypt } from "../../cryptoCipher/cryptoCipher.core.js";
-import { cryptoCipherError, CryptoOperation } from "@zudojs/errors";
-export async function serviceEncrypt(plaintext, key, options) {
+import { CryptoOperation } from "@zudojs/errors";
+import { cipherError, rethrowAsCryptoError, } from "../../cryptoErrors/cryptoErrors.helper.js";
+export async function serviceEncrypt(plaintext, key, options, provider) {
     try {
-        return await encrypt(plaintext, key, options);
+        return await encrypt(plaintext, key, {
+            ...options,
+            provider: options?.provider ?? provider,
+        });
     }
-    catch {
-        throw cryptoCipherError("Encryption failed.", CryptoOperation.ENCRYPT);
+    catch (error) {
+        return rethrowAsCryptoError(error, (cause) => cipherError("Encryption failed.", CryptoOperation.ENCRYPT, "aes-256-gcm", cause));
     }
 }
-export async function serviceDecrypt(ciphertext, key, iv, authTag, aad) {
+export async function serviceDecrypt(ciphertext, key, iv, authTag, aad, provider) {
     try {
-        return await decrypt(ciphertext, key, iv, authTag, aad);
+        return await decrypt(ciphertext, key, iv, authTag, aad, provider);
     }
-    catch {
-        throw cryptoCipherError("Decryption failed.", CryptoOperation.DECRYPT);
+    catch (error) {
+        return rethrowAsCryptoError(error, (cause) => cipherError("Decryption failed.", CryptoOperation.DECRYPT, "aes-256-gcm", cause));
     }
 }
 //# sourceMappingURL=cryptoService.cipher.js.map

package/dist/cryptoService/operations/cryptoService.hash.d.ts

@@ -1,3 +1,4 @@
-export declare function serviceHash(value: string | Uint8Array): Promise<Uint8Array>;
-export declare function serviceHashHex(value: string | Uint8Array): Promise<string>;
+import type { CryptoProvider } from "../../cryptoProvider/index.js";
+export declare function serviceHash(value: string | Uint8Array, provider?: CryptoProvider): Promise<Uint8Array>;
+export declare function serviceHashHex(value: string | Uint8Array, provider?: CryptoProvider): Promise<string>;
 //# sourceMappingURL=cryptoService.hash.d.ts.map

package/dist/cryptoService/operations/cryptoService.hash.js

@@ -1,16 +1,15 @@
-import { createNodeCryptoProvider } from "../../node/index.js";
+import { getDefaultCryptoProvider } from "../../cryptoProvider/cryptoProvider.default.js";
 import { encode } from "../../cryptoEncoding/cryptoEncoding.core.js";
-import { cryptoHashError } from "@zudojs/errors";
-const provider = createNodeCryptoProvider();
-export async function serviceHash(value) {
+import { hashError, rethrowAsCryptoError, } from "../../cryptoErrors/cryptoErrors.helper.js";
+export async function serviceHash(value, provider = getDefaultCryptoProvider()) {
     try {
         return await provider.hash("sha256", value);
     }
-    catch {
-        throw cryptoHashError("Hashing failed.", "sha256");
+    catch (error) {
+        return rethrowAsCryptoError(error, (cause) => hashError("Hashing failed.", "sha256", cause));
     }
 }
-export async function serviceHashHex(value) {
-    return encode(await serviceHash(value), "hex");
+export async function serviceHashHex(value, provider) {
+    return encode(await serviceHash(value, provider), "hex");
 }
 //# sourceMappingURL=cryptoService.hash.js.map

package/dist/cryptoService/operations/cryptoService.password.d.ts

@@ -1,5 +1,10 @@
+import type { CryptoProvider } from "../../cryptoProvider/index.js";
 import type { PasswordHashOptions, PasswordHashResult } from "../../cryptoPassword/cryptoPassword.type.js";
 export type { PasswordHashOptions, PasswordHashResult };
-export declare function serviceHashPassword(password: string, options?: PasswordHashOptions): Promise<PasswordHashResult>;
-export declare function serviceVerifyPassword(password: string, encodedHash: string): Promise<boolean>;
+export declare function serviceHashPassword(password: string, options?: PasswordHashOptions, provider?: CryptoProvider): Promise<PasswordHashResult>;
+/**
+ * Verifies a password. Wrong passwords and malformed hashes yield false;
+ * non-string arguments are programmer errors and throw.
+ */
+export declare function serviceVerifyPassword(password: string, encodedHash: string, provider?: CryptoProvider): Promise<boolean>;
 //# sourceMappingURL=cryptoService.password.d.ts.map

package/dist/cryptoService/operations/cryptoService.password.js

@@ -1,19 +1,30 @@
 import { hashPassword, verifyPassword, } from "../../cryptoPassword/cryptoPassword.core.js";
-import { createCryptoError } from "@zudojs/errors";
-export async function serviceHashPassword(password, options) {
+import { CryptoOperation } from "@zudojs/errors";
+import { operationError, rethrowAsCryptoError, } from "../../cryptoErrors/cryptoErrors.helper.js";
+export async function serviceHashPassword(password, options, provider) {
     try {
-        return await hashPassword(password, options);
+        return await hashPassword(password, { ...options, provider });
     }
-    catch {
-        throw createCryptoError("Password hashing failed.", {});
+    catch (error) {
+        return rethrowAsCryptoError(error, (cause) => operationError("Password hashing failed.", CryptoOperation.KEY_DERIVATION, cause));
     }
 }
-export async function serviceVerifyPassword(password, encodedHash) {
+/**
+ * Verifies a password. Wrong passwords and malformed hashes yield false;
+ * non-string arguments are programmer errors and throw.
+ */
+export async function serviceVerifyPassword(password, encodedHash, provider) {
+    if (typeof password !== "string") {
+        throw new TypeError("Password must be a string.");
+    }
+    if (typeof encodedHash !== "string") {
+        throw new TypeError("Encoded password hash must be a string.");
+    }
     try {
-        return await verifyPassword(password, encodedHash);
+        return await verifyPassword(password, encodedHash, provider);
     }
-    catch {
-        return false;
+    catch (error) {
+        return rethrowAsCryptoError(error, (cause) => operationError("Password verification failed.", CryptoOperation.VERIFY_HASH, cause));
     }
 }
 //# sourceMappingURL=cryptoService.password.js.map

package/dist/cryptoService/operations/cryptoService.token.d.ts

@@ -1,7 +1,12 @@
+import type { CryptoProvider } from "../../cryptoProvider/index.js";
 import type { TokenOptions, TokenEncoding } from "../../cryptoToken/cryptoToken.core.js";
 export type { TokenOptions, TokenEncoding };
-export declare function serviceGenerateToken(options?: TokenOptions): Promise<string>;
-export declare function serviceGenerateOtp(digits?: number): Promise<string>;
-export declare function serviceHashToken(token: string): Promise<string>;
-export declare function serviceVerifyToken(token: string, expectedHash: string): Promise<boolean>;
+export declare function serviceGenerateToken(options?: TokenOptions, provider?: CryptoProvider): Promise<string>;
+export declare function serviceGenerateOtp(digits?: number, provider?: CryptoProvider): Promise<string>;
+export declare function serviceHashToken(token: string, provider?: CryptoProvider): Promise<string>;
+/**
+ * Verifies a token against its stored hash. Mismatches and malformed
+ * hashes yield false; non-string arguments throw.
+ */
+export declare function serviceVerifyToken(token: string, expectedHash: string, provider?: CryptoProvider): Promise<boolean>;
 //# sourceMappingURL=cryptoService.token.d.ts.map

package/dist/cryptoService/operations/cryptoService.token.js

@@ -1,36 +1,50 @@
 import { generateToken, generateOtp, } from "../../cryptoToken/cryptoToken.core.js";
 import { hashToken, verifyTokenHash, } from "../../cryptoToken/cryptoToken.hash.js";
-import { createCryptoError, cryptoHashError } from "@zudojs/errors";
-export async function serviceGenerateToken(options) {
+import { CryptoOperation } from "@zudojs/errors";
+import { hashError, operationError, rethrowAsCryptoError, } from "../../cryptoErrors/cryptoErrors.helper.js";
+export async function serviceGenerateToken(options, provider) {
     try {
-        return await generateToken(options);
+        return await generateToken({
+            ...options,
+            provider: options?.provider ?? provider,
+        });
     }
-    catch {
-        throw createCryptoError("Token generation failed.", {});
+    catch (error) {
+        return rethrowAsCryptoError(error, (cause) => operationError("Token generation failed.", CryptoOperation.RANDOM, cause));
     }
 }
-export async function serviceGenerateOtp(digits = 6) {
+export async function serviceGenerateOtp(digits = 6, provider) {
     try {
-        return await generateOtp(digits);
+        return await generateOtp(digits, provider);
     }
-    catch {
-        throw createCryptoError("OTP generation failed.", {});
+    catch (error) {
+        return rethrowAsCryptoError(error, (cause) => operationError("OTP generation failed.", CryptoOperation.RANDOM, cause));
     }
 }
-export async function serviceHashToken(token) {
+export async function serviceHashToken(token, provider) {
     try {
-        return await hashToken(token);
+        return await hashToken(token, provider);
     }
-    catch {
-        throw cryptoHashError("Token hashing failed.", "sha256");
+    catch (error) {
+        return rethrowAsCryptoError(error, (cause) => hashError("Token hashing failed.", "sha256", cause));
     }
 }
-export async function serviceVerifyToken(token, expectedHash) {
+/**
+ * Verifies a token against its stored hash. Mismatches and malformed
+ * hashes yield false; non-string arguments throw.
+ */
+export async function serviceVerifyToken(token, expectedHash, provider) {
+    if (typeof token !== "string") {
+        throw new TypeError("Token must be a string.");
+    }
+    if (typeof expectedHash !== "string") {
+        throw new TypeError("Expected token hash must be a string.");
+    }
     try {
-        return await verifyTokenHash(token, expectedHash);
+        return await verifyTokenHash(token, expectedHash, provider);
     }
-    catch {
-        return false;
+    catch (error) {
+        return rethrowAsCryptoError(error, (cause) => hashError("Token verification failed.", "sha256", cause));
     }
 }
 //# sourceMappingURL=cryptoService.token.js.map

package/dist/cryptoSignature/cryptoSignature.core.d.ts

@@ -1,17 +1,25 @@
+import type { CryptoProvider } from "../cryptoProvider/index.js";
 import type { CryptoInput } from "../cryptoProvider/index.js";
 import type { SignatureAlgorithm } from "../cryptoProvider/index.js";
 /**
- * Supported signature algorithms.
+ * Signature options.
+ *
+ * The algorithm binds the key type: RSA algorithms require RSA keys,
+ * ECDSA algorithms require EC keys and `ed25519` requires an Ed25519 key.
  */
 export type SignatureOptions = {
     readonly algorithm?: SignatureAlgorithm;
+    readonly provider?: CryptoProvider;
 };
 /**
- * Signs arbitrary data using a private key.
+ * Signs arbitrary data using a private key (PEM text, DER bytes or KeyObject).
  */
 export declare function sign(data: Uint8Array, privateKey: CryptoInput, options?: SignatureOptions): Promise<Uint8Array>;
 /**
  * Verifies a signature using a public key.
+ *
+ * Returns false for malformed keys or signatures; throws only when the
+ * algorithm is unsupported or incompatible with the key type.
  */
 export declare function verify(data: Uint8Array, signature: Uint8Array, publicKey: CryptoInput, options?: SignatureOptions): Promise<boolean>;
 /**

package/dist/cryptoSignature/cryptoSignature.core.js

@@ -1,9 +1,9 @@
-import { createNodeCryptoProvider } from "../node/index.js";
-const provider = createNodeCryptoProvider();
+import { getDefaultCryptoProvider } from "../cryptoProvider/cryptoProvider.default.js";
 /**
- * Signs arbitrary data using a private key.
+ * Signs arbitrary data using a private key (PEM text, DER bytes or KeyObject).
  */
 export async function sign(data, privateKey, options = {}) {
+    const provider = options.provider ?? getDefaultCryptoProvider();
     return provider.sign({
         key: privateKey,
         data,
@@ -12,8 +12,12 @@ export async function sign(data, privateKey, options = {}) {
 }
 /**
  * Verifies a signature using a public key.
+ *
+ * Returns false for malformed keys or signatures; throws only when the
+ * algorithm is unsupported or incompatible with the key type.
  */
 export async function verify(data, signature, publicKey, options = {}) {
+    const provider = options.provider ?? getDefaultCryptoProvider();
     return provider.verify({
         key: publicKey,
         data,

package/dist/cryptoToken/cryptoToken.core.d.ts

@@ -1,3 +1,4 @@
+import type { CryptoProvider } from "../cryptoProvider/index.js";
 /**
  * Supported token encodings.
  */
@@ -9,47 +10,52 @@ export interface TokenOptions {
     readonly bytes?: number;
     readonly encoding?: TokenEncoding;
     readonly prefix?: string;
+    readonly provider?: CryptoProvider;
 }
 /**
  * Creates a cryptographically secure opaque token.
+ *
+ * The encoding is validated at runtime: only `hex`, `base64` and
+ * `base64url` are accepted, so a misconfigured `"utf8"` can never
+ * produce a lossy token.
  */
 export declare function generateToken(options?: TokenOptions): Promise<string>;
 /**
  * Generates a secure API key.
  */
-export declare function generateApiKey(prefix?: string, bytes?: number): Promise<string>;
+export declare function generateApiKey(prefix?: string, bytes?: number, provider?: CryptoProvider): Promise<string>;
 /**
  * Generates a secure session token.
  */
-export declare function generateSessionToken(bytes?: number): Promise<string>;
+export declare function generateSessionToken(bytes?: number, provider?: CryptoProvider): Promise<string>;
 /**
  * Generates a secure refresh token.
  */
-export declare function generateRefreshToken(bytes?: number): Promise<string>;
+export declare function generateRefreshToken(bytes?: number, provider?: CryptoProvider): Promise<string>;
 /**
  * Generates a secure verification token.
  */
-export declare function generateVerificationToken(bytes?: number): Promise<string>;
+export declare function generateVerificationToken(bytes?: number, provider?: CryptoProvider): Promise<string>;
 /**
  * Generates a secure password-reset token.
  */
-export declare function generatePasswordResetToken(bytes?: number): Promise<string>;
+export declare function generatePasswordResetToken(bytes?: number, provider?: CryptoProvider): Promise<string>;
 /**
  * Generates a secure CSRF token.
  */
-export declare function generateCsrfToken(bytes?: number): Promise<string>;
+export declare function generateCsrfToken(bytes?: number, provider?: CryptoProvider): Promise<string>;
 /**
  * Generates a numeric one-time password.
  *
  * Leading zeroes are preserved.
  */
-export declare function generateOtp(digits?: number): Promise<string>;
+export declare function generateOtp(digits?: number, provider?: CryptoProvider): Promise<string>;
 /**
  * Generates a short-lived email verification code.
  */
-export declare function generateEmailVerificationCode(digits?: number): Promise<string>;
+export declare function generateEmailVerificationCode(digits?: number, provider?: CryptoProvider): Promise<string>;
 /**
  * Generates a short-lived login verification code.
  */
-export declare function generateLoginCode(digits?: number): Promise<string>;
+export declare function generateLoginCode(digits?: number, provider?: CryptoProvider): Promise<string>;
 //# sourceMappingURL=cryptoToken.core.d.ts.map

package/dist/cryptoToken/cryptoToken.core.js

@@ -1,90 +1,115 @@
-import { createNodeCryptoProvider } from "../node/index.js";
+import { getDefaultCryptoProvider } from "../cryptoProvider/cryptoProvider.default.js";
 import { randomInteger } from "../cryptoRandom/cryptoRandom.core.js";
-let defaultProvider;
-/**
- * Returns a lazily created default crypto provider.
- *
- * The provider abstraction keeps token generation free of direct
- * `node:crypto` usage while still allowing callers to inject their own.
- */
-function getDefaultProvider() {
-    if (defaultProvider === undefined) {
-        defaultProvider = createNodeCryptoProvider();
-    }
-    return defaultProvider;
-}
+import { assertBinaryEncoding } from "../cryptoEncoding/cryptoEncoding.core.js";
+import { RANDOM, TOKEN, TOKEN_PREFIX, } from "../cryptoConstants/cryptoConstants.token.js";
 /**
  * Creates a cryptographically secure opaque token.
+ *
+ * The encoding is validated at runtime: only `hex`, `base64` and
+ * `base64url` are accepted, so a misconfigured `"utf8"` can never
+ * produce a lossy token.
  */
 export async function generateToken(options = {}) {
-    const bytes = options.bytes ?? 32;
+    const bytes = options.bytes ?? TOKEN.DEFAULT_BYTES;
     const encoding = options.encoding ?? "base64url";
-    if (!Number.isInteger(bytes) || bytes < 16) {
-        throw new RangeError("Token byte length must be an integer of at least 16.");
+    if (!Number.isInteger(bytes) || bytes < RANDOM.MIN_BYTES) {
+        throw new RangeError(`Token byte length must be an integer of at least ${RANDOM.MIN_BYTES}.`);
+    }
+    assertBinaryEncoding(encoding);
+    if (options.prefix !== undefined && typeof options.prefix !== "string") {
+        throw new TypeError("Token prefix must be a string.");
     }
-    const raw = await getDefaultProvider().randomBytes(bytes);
+    const provider = options.provider ?? getDefaultCryptoProvider();
+    const raw = await provider.randomBytes(bytes);
     const token = Buffer.from(raw).toString(encoding);
     return options.prefix ? `${options.prefix}${token}` : token;
 }
 /**
  * Generates a secure API key.
  */
-export async function generateApiKey(prefix = "lat_", bytes = 32) {
-    return generateToken({ bytes, encoding: "base64url", prefix });
+export async function generateApiKey(prefix = TOKEN_PREFIX.API_KEY, bytes = TOKEN.API_KEY_BYTES, provider) {
+    return generateToken({ bytes, encoding: "base64url", prefix, provider });
 }
 /**
  * Generates a secure session token.
  */
-export async function generateSessionToken(bytes = 32) {
-    return generateToken({ bytes, encoding: "base64url", prefix: "sess_" });
+export async function generateSessionToken(bytes = TOKEN.SESSION_BYTES, provider) {
+    return generateToken({
+        bytes,
+        encoding: "base64url",
+        prefix: TOKEN_PREFIX.SESSION,
+        provider,
+    });
 }
 /**
  * Generates a secure refresh token.
  */
-export async function generateRefreshToken(bytes = 48) {
-    return generateToken({ bytes, encoding: "base64url", prefix: "ref_" });
+export async function generateRefreshToken(bytes = TOKEN.REFRESH_BYTES, provider) {
+    return generateToken({
+        bytes,
+        encoding: "base64url",
+        prefix: TOKEN_PREFIX.REFRESH,
+        provider,
+    });
 }
 /**
  * Generates a secure verification token.
  */
-export async function generateVerificationToken(bytes = 32) {
-    return generateToken({ bytes, encoding: "base64url", prefix: "verify_" });
+export async function generateVerificationToken(bytes = TOKEN.VERIFICATION_BYTES, provider) {
+    return generateToken({
+        bytes,
+        encoding: "base64url",
+        prefix: TOKEN_PREFIX.VERIFICATION,
+        provider,
+    });
 }
 /**
  * Generates a secure password-reset token.
  */
-export async function generatePasswordResetToken(bytes = 32) {
-    return generateToken({ bytes, encoding: "base64url", prefix: "reset_" });
+export async function generatePasswordResetToken(bytes = TOKEN.PASSWORD_RESET_BYTES, provider) {
+    return generateToken({
+        bytes,
+        encoding: "base64url",
+        prefix: TOKEN_PREFIX.PASSWORD_RESET,
+        provider,
+    });
 }
 /**
  * Generates a secure CSRF token.
  */
-export async function generateCsrfToken(bytes = 32) {
-    return generateToken({ bytes, encoding: "base64url", prefix: "csrf_" });
+export async function generateCsrfToken(bytes = TOKEN.CSRF_BYTES, provider) {
+    return generateToken({
+        bytes,
+        encoding: "base64url",
+        prefix: TOKEN_PREFIX.CSRF,
+        provider,
+    });
 }
 /**
  * Generates a numeric one-time password.
  *
  * Leading zeroes are preserved.
  */
-export async function generateOtp(digits = 6) {
-    if (!Number.isInteger(digits) || digits < 4 || digits > 12) {
-        throw new RangeError("OTP digits must be an integer between 4 and 12.");
+export async function generateOtp(digits = TOKEN.OTP_DIGITS, provider) {
+    if (!Number.isInteger(digits) ||
+        digits < TOKEN.OTP_MIN_DIGITS ||
+        digits > TOKEN.OTP_MAX_DIGITS) {
+        throw new RangeError(`OTP digits must be an integer between ${TOKEN.OTP_MIN_DIGITS} and ${TOKEN.OTP_MAX_DIGITS}.`);
     }
     const max = 10 ** digits;
-    const value = await randomInteger(0, max);
+    const value = await randomInteger(0, max, provider);
     return String(value).padStart(digits, "0");
 }
 /**
  * Generates a short-lived email verification code.
  */
-export async function generateEmailVerificationCode(digits = 6) {
-    return generateOtp(digits);
+export async function generateEmailVerificationCode(digits = TOKEN.OTP_DIGITS, provider) {
+    return generateOtp(digits, provider);
 }
 /**
  * Generates a short-lived login verification code.
  */
-export async function generateLoginCode(digits = 6) {
-    return generateOtp(digits);
+export async function generateLoginCode(digits = TOKEN.OTP_DIGITS, provider) {
+    return generateOtp(digits, provider);
 }
 //# sourceMappingURL=cryptoToken.core.js.map

package/dist/cryptoToken/cryptoToken.hash.d.ts

@@ -1,24 +1,26 @@
+import type { CryptoProvider } from "../cryptoProvider/index.js";
 /**
  * Creates a deterministic SHA-256 identifier from a token.
  *
  * The returned value does not expose the original token.
  */
-export declare function hashToken(token: string): Promise<string>;
+export declare function hashToken(token: string, provider?: CryptoProvider): Promise<string>;
 /**
  * Creates a Base64URL SHA-256 digest of a token.
  */
-export declare function hashTokenBase64Url(token: string): Promise<string>;
+export declare function hashTokenBase64Url(token: string, provider?: CryptoProvider): Promise<string>;
 /**
- * Compares a token with a stored hash.
+ * Compares a token with a stored hex SHA-256 hash.
  *
- * Comparison is performed with a constant-time XOR accumulation to
- * avoid timing side-channels.
+ * The comparison is constant time and case-insensitive on the hex digits,
+ * so hashes upper-cased by a database or copied from another tool still
+ * match. Returns false for a malformed token or stored hash.
  */
-export declare function verifyTokenHash(token: string, expectedHash: string): Promise<boolean>;
+export declare function verifyTokenHash(token: string, expectedHash: string, provider?: CryptoProvider): Promise<boolean>;
 /**
  * Hashes a token using SHA-256 before storage.
  *
  * This is useful when a raw bearer token must never be persisted.
  */
-export declare function hashTokenForStorage(token: string): Promise<string>;
+export declare function hashTokenForStorage(token: string, provider?: CryptoProvider): Promise<string>;
 //# sourceMappingURL=cryptoToken.hash.d.ts.map